Skip to content
Enclessa
Get started

Glossary · Compliance

Subprocessor

All termsHow Enclessa secures data

A subprocessor is a third party that a processor engages to carry out part of the processing of personal data on the controller’s behalf — a hosting provider, a payment provider or an email relay, for example.

Open betaThe platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta. What is still being built.

Also called

Sub-processor

What Subprocessor means

The chain matters because the controller’s obligations do not stop at the first vendor. Article 28 requires the processor to impose the same data protection terms on anybody it engages, and to remain fully liable to the controller for what that party does. A vendor cannot subcontract away a duty it owes.

Two forms of authorisation exist. Specific authorisation means the controller approves each subprocessor individually, which is thorough and unworkable at scale. General authorisation means the controller approves the practice in advance on condition of being notified of changes and given a right to object, which is what nearly every SaaS contract uses. The value of general authorisation depends entirely on the notice period actually being honoured.

The most common defect in a subprocessor disclosure is not an omission but a divergence: the list in the privacy notice and the list in the DPA annex have drifted apart. A reviewer who checks both and finds different names has learned something about the vendor’s process, not just about its subprocessors.

How Enclessa uses it

Enclessa maintains a subprocessor list covering hosting, payments, transactional email and operational tooling, and commits to keeping the DPA annex and the privacy notice in step with each other. The specific entities and the notice period are recorded on the trust centre; where a value is not yet settled in the repository it appears as a marked placeholder rather than a guess.

Where Subprocessor is specified

Related terms

Data processing agreement (DPA)A data processing agreement is the contract required by Article 28 of the GDPR between a controller and a processor, setting out what the processor may do with personal data, on whose instructions, with what security, and what happens at the end.Read the entryGDPRThe GDPR is Regulation (EU) 2016/679, the European Union law that governs the processing of personal data and applies to any organisation processing the data of people in the EU, wherever that organisation is established.Read the entryData residencyData residency is the requirement that data be stored and processed within a named geographic territory, usually a country or an economic area such as the European Union.Read the entryMulti-tenancyMulti-tenancy is an architecture in which one running installation of an application serves many independent customer organisations, each of which sees only its own data.Read the entry

Read further

The security page explains how Enclessa protects data and which certifications it does not hold. The trust centre covers the processing agreement, the subprocessors and the residency position. The FAQ answers the questions buyers ask most often.

Encrypted collaboration, hosted in Europe.

Create a workspace in a couple of minutes. It is yours at your-team.enclessa.app, hosted in the European Union, with encrypted direct messages from the first one you send.

Create your workspaceSee pricing

Open beta. Free plan, no payment card to start.